Economic security is no longer limited to protecting a building or a computer network. It means safeguarding what enables a business to make decisions, produce, innovate and endure.
The Gendarmerie nationale guide: https://www.gendarmerie.interieur.gouv.fr/content/download/61216/file/Guide_Atteintes_S%C3%A9curit%C3%A9_Economique_Gendarmerie_nationale.pdf?inLanguage=fre-FR&version=6
makes this idea tangible for PME and ETI. It connects physical, digital, human, legal and reputational threats, then suggests preventive habits.
References from abroad and research findings confirm this comprehensive approach.
However, they call for further efforts in governance, risk measurement, partner monitoring and incident preparedness.
A comprehensive map of threats
The first contribution of the Gendarmerie nationale guide lies in its scope. It describes seven families of threats: site security, intrusions through authorised access, threats to know-how, fraud, ecosystem vulnerabilities, cyberattacks and information attacks.
This structure shows that a single operation can combine several vectors. An apparently ordinary visit can facilitate the acquisition of plans.
A compromised account can be used to divert a payment, steal data and spread false information. A vulnerable supplier can become an entry point to a strategic customer.
The Gendarmerie nationale guide rightly emphasises PME and ETI.
Their technical expertise and their position in value chains make them attractive targets, while their resources for protection are often more limited. It also reminds readers that threats do not come only from outside. An employee, service provider, visitor, investor or partner may have legitimate access that becomes dangerous through negligence, pressure or malicious intent. This perspective avoids reducing economic security to cybersecurity alone.
The section on good practices then turns these observations into practical measures.
It covers confidentiality, personal data, contractual clauses, restricted-access areas, control of visitor routes, the appointment of a security officer and the business continuity plan. The section on social responsibility provides a useful complement. Transparent governance, healthy working relationships, fair conduct and strong local ties reduce certain internal weaknesses and strengthen partners’ trust.
Protection based on critical assets
The guiding principle of the Gendarmerie nationale guide is simple: a business must first know what it cannot afford to lose. This could be a prototype, a process, customer data, rare skills, a unique site, a dominant supplier or a brand’s reputation. Protection must then be proportionate to the value of these assets and the consequences of a compromise.
This logic is consistent with the British Secure Innovation framework, published by the National Protective Security Authority and the National Cyber Security Centre.
This framework asks the management board to appoint a person responsible, identify critical assets, record security risks in the risk register, then vet investors, suppliers and prospective employees.
The same consistency appears in the NIST Cybersecurity Framework 2.0 in the United States.
Its six functions are govern, identify, protect, detect, respond and recover. This sequence complements the French guide well: the guide is very detailed on forms of harm and preventive measures, but less explicit about management indicators.
A business should be able to track a few simple data points: the proportion of critical assets inventoried, sensitive access permissions reviewed, backups restored during tests, suppliers assessed, incidents reported and crisis exercises conducted.
Legal protection must also rest on observable practices. The guide reminds readers that trade secret protection requires reasonable protective measures.
The World Intellectual Property Organization sets out the approach: identify and value potential secrets, apply appropriate measures, monitor leaks and respond. A confidentiality agreement is therefore not enough if documents remain freely accessible, access rights are never withdrawn after someone leaves, or exchanges with a partner are not documented.
Contributions from approaches abroad
International studies reinforce several messages in the guide.
ENISA surveyed 249 PME in 25 European states.
More than 80 per cent reported handling critical information. Most used basic protections, such as antivirus software, backups and firewalls, but staff training, logging and alerts remained less common. The study also found that phishing, malware and web-based attacks were among the most frequent causes of incidents.
Human risk must therefore be addressed through vetting procedures, short and repeated training sessions, and technical controls.
Carnegie Mellon’s Software Engineering Institute provides an empirical basis for understanding insider risk.
Its 2022 guide is based on more than 3000 cases and sets out 22 practices.
It recommends coordinated action involving management, human resources, legal functions, physical security, IT and data owners. This approach could strengthen the French guide by replacing awareness-raising alone with a formal programme that respects labour law and privacy, with clear rules for recruitment, job changes, periods of tension and departures.
Finally, the European Commission offers a broader framework.
Its economic security strategy distinguishes four areas: supply chain resilience, the physical and digital security of critical infrastructure, technology security and the risk of leakage, and the coercive use of economic dependencies.
The OCDE’s 2025 report adds a useful warning. Risks are interconnected, but an overly broad response can weaken the benefits of open markets. The right response is to map genuinely critical dependencies, plan alternatives and maintain diversified international cooperation.
Moving from a catalogue to a programme that can be managed
The Gendarmerie nationale guide provides an excellent basis for raising awareness, with an implementation path built around four priorities.
1 Identify vital assets Link each asset to its holders, access permissions, dependencies and maximum tolerable downtime.
2 Organise responsibility Appoint a person responsible with management support and regularly bring together security, IT, human resources, legal, purchasing and communications functions.
3 Control access and partners Apply the need-to-know principle, review access rights, prepare visits, assess suppliers and investors, then include verifiable security clauses in contracts.
4 Prepare for a crisis Test backups, the continuity plan, the decision to report an incident, evidence preservation and communication with customers, authorities and partners.
Economic security thus becomes a governance discipline, integrated into decisions on investment, partnerships, innovation and international development.
International sources
• European Commission, 2023, European Economic Security Strategy
• National Protective Security Authority and National Cyber Security Centre, 2024, Secure Innovation
• ENISA, 2021, Cybersecurity for PME
• World Intellectual Property Organization, Guide to trade secrets and innovation
